How 1club handles your personal data on the 1club marketplace
Last updated: November 2, 2026
The 1club marketplace at 1club.me, where you find and book clubs, courts, classes and coaches, is run by 1club EOOD ("1club", "we", "us"), a company registered in Bulgaria under UIC 208644166, with its registered office at 10 Tsar Osvoboditel Blvd., floor 3, 1000 Sofia, Bulgaria.
1club is the controller of the personal data described in this policy under Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and the Bulgarian Personal Data Protection Act. For any question about your data, or to exercise your rights, write to support@1club.ai or to the address above.
This policy covers 1club.me, the marketplace's AI assistant connection at mcp.1club.me, and the emails and messages we send you about your marketplace account.
The clubs on the marketplace are independent businesses. When you book, register for an event, join, buy a plan or send a message to a club, the club receives your details and becomes the controller of its own record of you: your bookings, memberships, payments, attendance and messages with it. Each club handles that data under its own privacy notice, and runs its business on 1club's software, for which 1club acts as the club's processor under Article 28 GDPR. The section "What we share with clubs" explains what we pass to clubs and what they do with it.
1club.ai, our software for clubs, has its own privacy policy for the club staff who use it.
We collect the data you give us, the data your use of the marketplace creates, and limited data from the sign-in services you choose. The legal bases are the performance of our contract with you (Article 6(1)(b) GDPR), our legitimate interests (Article 6(1)(f)), your consent (Article 6(1)(a)) and our legal obligations (Article 6(1)(c)).
| When | What we process | Why and on what basis |
|---|---|---|
| You visit 1club.me | IP address, browser and device type, language, pages requested, the referring page, the time of the visit, and your approximate location (city and country) derived from your IP address. | To deliver the pages, show clubs near you and keep the marketplace secure. Legitimate interest. |
| You create an account | Your name, email address and/or phone number, your password (stored only as a one-way hash), the date and version of the Terms of Service you accepted. If you sign in with Google, Facebook or Apple: the account identifier, name and email address that service shares with us, and your profile photo (Google and Facebook). | To create and run your account. Contract. Keeping a record of the terms you accepted: legitimate interest. |
| You sign in with a one-time code | Your phone number or email address and the code we send. Phone codes go by WhatsApp where possible and otherwise by SMS. | To confirm it is you. Contract. |
| You stay signed in | For each sign-in session: IP address, browser, a random device identifier and the times of sign-in and renewal. When you send certain forms, a bot check by Cloudflare Turnstile. | To keep you signed in and protect your account and the marketplace from abuse. Contract and legitimate interest. |
| You complete your profile | Optionally: profile photo, date of birth, gender, address and the household members you add, such as your children. | So clubs have what they need for your bookings and you do not have to type it again. Contract. |
| You search | What you type, the filters, dates and times you choose, and the location you enter or allow your browser to share. The text you type in the search bar is sent to OpenAI to work out what you are looking for. We also log searches with the location rounded to about 1 km and a random session identifier, without your name or account. | To show relevant clubs and availability, and to improve search and see which sports and places people look for. Contract and legitimate interest. |
| You save clubs | The clubs you add to your favourites. | To show them to you. Contract. |
| You open a club's invite link | The club and the time you opened its link. | To show you that club in the 1club App for as long as the club keeps the link valid. Contract. |
| A club already has your email address or phone number | Your verified email address or phone number, matched against the member lists of the clubs that use 1club. The club is not told about the match. | To show you the clubs you already belong to in the 1club App, including clubs that are not on the marketplace. Legitimate interest. |
| You book, register or buy | The club, service, date and time, the people you book for or add as players (name and email address), the price and payment status, and your booking history. When you arrive from a club's printed QR code, the booking or purchase you make on that visit, and your record at that club, note that it came from the code. | To make the booking with the club and show it in your account. Contract. |
| You book an independent professional to come to you | The address you give for the session. | So that the professional can come to you. It goes to that professional and to nobody else. Contract. |
| You write a review | Your rating, title, text and photos, your answers to the review questions, any private note you write for the club, the booking it relates to, and the date. Your name, profile photo, the date and what you booked are shown with the review. | To publish your review at your request, and to check that it comes from a real visit. Your answers are published only added up across reviewers, never next to your name, and a private note goes only to the club. Contract and legitimate interest in honest reviews. |
| A visit you booked through 1club ends | Your name, email address and the booking. | To invite you to rate the visit, by email and at most once a month, when the club is listed on the marketplace. Legitimate interest in honest, verified reviews. The unsubscribe link in the invitation stops them, together with that club's news and offers, separately for each club. |
| You contact us or a coach | What you write, your name and contact details, and the page you wrote from. | To answer you, or to pass your enquiry to the coach or club it is meant for. Legitimate interest, or steps you asked for before a contract. |
| You list yourself as an independent professional | Your public profile: the name you choose to show, your photo and gallery images, bio, experience, certifications, sports, hourly rate, working hours and reviews, and the places you teach at. If you add an address of your own as a place, that address and its position on the map; for the area you travel to, its radius and its centre rounded to about 1 km. | To show your profile on the marketplace at your request, and only while it is listed, so that clients can find and book you. Contract. |
| You accept optional cookies | How you use the marketplace (pages, clicks, features used), session replays with typed text hidden, and the campaign or link that brought you here. | To understand and improve the marketplace and measure where visitors come from. Consent, which you can withdraw at any time. See the Cookie Policy. |
| Something goes wrong | A technical report of the error: the page, browser, device type and the steps that led to it. | To find and fix faults. Legitimate interest. |
| The law requires it | The data needed to answer a lawful request from a court or authority, or to establish, exercise or defend legal claims. | Legal obligation, or legitimate interest in protecting our rights. |
Where we rely on legitimate interests, we have weighed them against your interests and rights, and you can object at any time (see "Your rights").
We do not ask for, and ask you not to share, special categories of data such as health information. If a club needs to know about a health condition, tell the club directly.
The marketplace search uses OpenAI to understand what you type, for example "tennis tomorrow after 6". Only the text you type and your time zone are sent, not your name or account. Please do not type personal information into the search bar. A club's page may also show a short summary of its published reviews, which OpenAI writes from their ratings and text, without the reviewers' names.
You can also connect an AI assistant, such as ChatGPT, to your 1club account at mcp.1club.me/me. After you sign in and approve the connection, the assistant can show your bookings and, at your request, book, join or leave a waitlist and cancel on your behalf. Your conversation with the assistant is handled by its provider under its own privacy policy; we receive only the requests the assistant makes and keep a record of the connection. You can disconnect it at any time.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects within the meaning of Article 22 GDPR. How search results are ordered is explained in the Terms of Service.
When you book, register for an event, join a club, buy a plan, message a club or review a visit, we pass to that club what it needs to serve you: your name, email address and phone number, the profile details you have filled in (photo, date of birth, gender, address), the booking, purchase or review itself, including your answers to the review questions and any private note, and, if you accepted marketing cookies, the link or campaign that brought you to the marketplace. Browsing a club's page does not share anything with it.
The club then holds this data as an independent controller under its own privacy notice. The details are kept the same in both directions while you remain its customer: changes you make to your profile on 1club.me update your details at the clubs you have used, and when a club updates your name, phone number, address, date of birth or gender, your 1club profile is updated too. If a club changes your phone number, signing in by phone needs the new number to be verified again.
To exercise your rights over the data a club holds, contact the club. If you are unsure how, write to us and we will help.
We use service providers that process data on our behalf, under contracts that require them to protect it and use it only for us:
| Provider | What they do | Where |
|---|---|---|
| Google Cloud (Google LLC) | Hosting of our servers, database and backups | United States |
| Vercel Inc. | Hosting of the website | United States and worldwide edge network |
| Cloudflare, Inc. | Network, security and bot checks (Turnstile) | United States and worldwide edge network |
| Twilio Inc. (SendGrid and Twilio) | Sending emails and SMS codes | United States |
| Meta Platforms (WhatsApp) | Sending sign-in codes by WhatsApp | Ireland and United States |
| OpenAI | Understanding search text, summarizing published reviews | United States |
| Mapbox, Inc. | Maps and place search | United States |
| Cloudinary Ltd. | Storing and delivering photos, including profile and review photos | United States |
| PostHog Inc. | Product analytics, only with your consent | European Union |
| Functional Software, Inc. (Sentry) | Error monitoring and, with your consent, session replays | European Union (Germany) |
| Google Ireland Ltd | Sign-in with Google, maps on club pages and, with your consent, Google Analytics | Ireland and United States |
| ip-api.com | Approximate location from your IP address | Outside the EU |
Payments to a club are processed by the payment provider the club uses (Stripe, myPOS or DatecsPay), as the club's provider; your card details go to that provider and never reach 1club.
We do not sell your personal data. Apart from the campaign information a club receives with your booking, sign-up or purchase if you accepted marketing cookies (see "What we share with clubs"), we do not share it for anyone's advertising.
Several of our providers, including the hosting of our database, are in the United States, so your data is transferred outside the European Economic Area. We transfer it only on the basis of the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, for providers certified under it, or of the Standard Contractual Clauses adopted by the European Commission, together with any additional safeguards needed. You can ask us for a copy of the safeguards that apply.
Under the GDPR you have the right to:
You can delete your account yourself at any time under My Account, with "Delete account". To exercise your other rights, write to support@1club.ai from the email address on your account, or tell us how else we can confirm it is you. We reply within one month, which we may extend by two further months for complex or numerous requests, telling you why within the first month.
The supervisory authority in Bulgaria is the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, kzld@cpdp.bg, https://www.cpdp.bg. You can also complain to the authority in the EU country where you live or work, or where you believe the infringement took place.
You can browse the marketplace without giving us any personal data. To create an account we need your name and an email address or phone number, and your phone number as well when you sign up with an email address and a password; to make a booking, the club may need further details, which the booking form marks as required. Without them we cannot open the account or make the booking. Everything else is optional.
The marketplace is not meant for children to use on their own. You need to be at least 18 to have an account, or at least 14 with the consent of a parent or guardian. Parents and guardians can add their children as household members and book for them; they then provide the child's data, and the club processes it to provide the service.
If you believe a child under 14 has given us personal data without a parent's consent, contact us and we will delete it.
We use technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, passwords stored only as one-way hashes, short-lived sign-in tokens, access limited to staff who need it, and the removal of passwords and tokens from our logs. No system is completely secure; if a breach affects your data and is likely to put your rights at high risk, we will tell you without undue delay.
We will update this policy when the way we handle data changes. The date at the top shows the current version. If a change matters to you, we will tell you by email or on the marketplace before it takes effect.
1club EOOD, 10 Tsar Osvoboditel Blvd., floor 3, 1000 Sofia, Bulgaria. Email: support@1club.ai.